diff options
author | John Levon <john.levon@nutanix.com> | 2021-11-24 23:59:24 +0000 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-11-24 23:59:24 +0000 |
commit | 02174878b1f7a70d3ac09c50c12799df0a1f9406 (patch) | |
tree | 62cdd8b99de889d310a65ddbdf2ad5b5257f403d /test/py/test_dma_unmap.py | |
parent | d8a08f1a18370bcad4fa99a16bdbfc63dbbd35ad (diff) | |
download | libvfio-user-02174878b1f7a70d3ac09c50c12799df0a1f9406.zip libvfio-user-02174878b1f7a70d3ac09c50c12799df0a1f9406.tar.gz libvfio-user-02174878b1f7a70d3ac09c50c12799df0a1f9406.tar.bz2 |
verify region is mapped before acquiring dirty bitmap (#627)
DMA regions not mapped by the server are not dirty tracked (the client must
track changes via handling VFIO_USER_DMA_WRITE), but we weren't correctly
enforcing this, which could segfault when ->dirty_bitmap was NULL.
Found via AFL++.
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Thanos Makatos <thanos.makatos@nutanix.com>
Diffstat (limited to 'test/py/test_dma_unmap.py')
-rw-r--r-- | test/py/test_dma_unmap.py | 44 |
1 files changed, 42 insertions, 2 deletions
diff --git a/test/py/test_dma_unmap.py b/test/py/test_dma_unmap.py index f1da4b0..a449990 100644 --- a/test/py/test_dma_unmap.py +++ b/test/py/test_dma_unmap.py @@ -29,6 +29,7 @@ # import errno +import tempfile from libvfio_user import * ctx = None @@ -40,7 +41,18 @@ def test_dma_unmap_setup(): ctx = prepare_ctx_for_dma() assert ctx is not None - payload = struct.pack("II", 0, 0) + f = tempfile.TemporaryFile() + f.truncate(0x2000) + + mmap_areas = [(0x1000, 0x1000)] + + ret = vfu_setup_region(ctx, index=VFU_PCI_DEV_MIGR_REGION_IDX, size=0x2000, + flags=VFU_REGION_FLAG_RW, mmap_areas=mmap_areas, + fd=f.fileno()) + assert ret == 0 + + ret = vfu_realize_ctx(ctx) + assert ret == 0 sock = connect_client(ctx) @@ -76,13 +88,41 @@ def test_dma_unmap_dirty_bad_argsz(): argsz = len(vfio_user_dma_unmap()) + len(vfio_user_bitmap()) unmap = vfio_user_dma_unmap(argsz=argsz, - flags=VFIO_DMA_UNMAP_FLAG_GET_DIRTY_BITMAP, addr=0x10000, size=4096) + flags=VFIO_DMA_UNMAP_FLAG_GET_DIRTY_BITMAP, addr=0x1000, size=4096) bitmap = vfio_user_bitmap(pgsize=4096, size=(UINT64_MAX - argsz) + 8) payload = bytes(unmap) + bytes(bitmap) msg(ctx, sock, VFIO_USER_DMA_UNMAP, payload, expect=errno.EINVAL) +def test_dma_unmap_dirty_not_tracking(): + + argsz = len(vfio_user_dma_unmap()) + len(vfio_user_bitmap()) + 8 + unmap = vfio_user_dma_unmap(argsz=argsz, + flags=VFIO_DMA_UNMAP_FLAG_GET_DIRTY_BITMAP, addr=0x1000, size=4096) + bitmap = vfio_user_bitmap(pgsize=4096, size=8) + payload = bytes(unmap) + bytes(bitmap) + bytes(8) + + msg(ctx, sock, VFIO_USER_DMA_UNMAP, payload, expect=errno.EINVAL) + + +def test_dma_unmap_dirty_not_mapped(): + + vfu_setup_device_migration_callbacks(ctx, offset=0x1000) + payload = vfio_user_dirty_pages(argsz=len(vfio_user_dirty_pages()), + flags=VFIO_IOMMU_DIRTY_PAGES_FLAG_START) + + msg(ctx, sock, VFIO_USER_DIRTY_PAGES, payload) + + argsz = len(vfio_user_dma_unmap()) + len(vfio_user_bitmap()) + 8 + unmap = vfio_user_dma_unmap(argsz=argsz, + flags=VFIO_DMA_UNMAP_FLAG_GET_DIRTY_BITMAP, addr=0x1000, size=4096) + bitmap = vfio_user_bitmap(pgsize=4096, size=8) + payload = bytes(unmap) + bytes(bitmap) + bytes(8) + + msg(ctx, sock, VFIO_USER_DMA_UNMAP, payload, expect=errno.EINVAL) + + def test_dma_unmap_invalid_flags(): payload = vfio_user_dma_unmap(argsz=len(vfio_user_dma_unmap()), |